ISO 45001 clause 6.1: connect hazards, requirements and action
ISO 45001:2018 clause 6.1 establishes planning for risks and opportunities affecting OH&S outcomes. It connects general planning, hazard identification, assessment of OH&S and other system risks and opportunities, legal and other requirements, and action. The purpose is to support prevention and improvement through decisions that reach actual work.
What clause 6.1 requires in practice
Clause 6.1 groups the standard's planning duties under one purpose: determining and addressing the risks and opportunities that bear on the system's outcomes. It has four subclauses. The general requirement in 6.1.1 sets the inputs and the duty to assess changes before they take effect. Subclause 6.1.2 covers hazard identification, assessing the OH&S risks, and any other risks, that bear on the system, and assessing opportunities. Subclause 6.1.3 covers legal and other requirements, and 6.1.4 covers planned action.
The clause distinguishes OH&S risk, which concerns harm to people from hazardous events or exposures, from other risks to the system's establishment and operation. It requires planning of actions for risks, opportunities, legal and other requirements and emergencies, how those actions will be integrated into processes and how their effectiveness will be judged. Best practice, technology and financial, operational and business requirements are considered, but the hierarchy of controls remains part of the thinking.
Use the correct planning structure
Clause 6.1.1 establishes the overall considerations and documented planning information. Clause 6.1.2 contains separate requirements for hazard identification, risk assessment and opportunity assessment. Clause 6.1.3 addresses applicable legal and other requirements, and clause 6.1.4 plans action and its evaluation.
These processes inform each other. New information about a hazard may change a risk assessment; a new requirement may change the control decision; an incident may reveal that assumptions about existing controls were wrong. Planning therefore needs ongoing connections rather than a single assessment completed before certification.
Distinguish work risks from system risks
OH&S risk concerns the likelihood and severity of harm from hazardous events or exposures. Other risks can affect the establishment, implementation, operation and maintenance of the management system itself. For example, loss of essential competence or an ineffective reporting route can undermine prevention even though it is not a physical hazard.
Opportunities can improve work arrangements, eliminate hazards, reduce risk or strengthen the system. They should be assessed in context. A proposed improvement may introduce new hazards and needs appropriate evaluation before implementation.
Why connecting hazards, requirements and action matters
Separate lists of hazards, laws and projects do not protect anyone unless they are joined up. Where the link is missing, a known hazard stays uncontrolled because the person who assessed it cannot commission a fix, or a legal change is noted without altering a procedure. Connected planning gets resources to the right place and lets leaders explain why one risk was tackled before another. It also gives a defensible account if something goes wrong, because the organisation can show what it knew, what it decided and what it did. Over time, this discipline reduces rework, since assessments are reused and updated rather than recreated for each audit.
How to implement clause 6.1
The subclauses interact, so build them as one flow. A route that Sterling teams use is described below. Keep the flow proportionate to the size and complexity of the organisation, with simple tools wherever they are enough. Record only what helps people act, and review it with the workers affected.
- Define who owns the overall planning flow and who contributes information from operations, purchasing and human resources.
- Agree how hazards, risks, opportunities and requirements will be recorded so each can be told apart and traced to action.
- Set the point at which a planned change triggers assessment, including temporary changes.
- Decide how new knowledge, such as an incident or a regulatory update, feeds back into earlier assessments.
- Plan actions with owners, resources and a way of checking that each action worked, applying the hierarchy of controls.
- Review a sample of actions to confirm that the planned controls are present in the real task and not only on paper.
Two illustrative planning chains
A manufacturer plans a maintenance activity involving employees and contractor workers. It identifies hazards from the actual task and interfaces, assesses risks considering existing controls, checks applicable requirements and selects actions using the hierarchy of controls. Worker participation helps test whether the planned arrangement is workable. Evaluation later examines how the controls operated, not only whether the assessment form was signed.
A software support company changes its release schedule. Workers identify how the change could affect workload and handovers. Management assesses the relevant work-related and system risks, considers opportunities to improve planning and checks applicable requirements. The resulting action may involve changes to the work arrangement rather than only asking staff to attend an awareness session.
Integrate action with the business
Planning should connect with purchasing, work design, competence, operational control, emergency arrangements and management review. The people who control those processes need ownership of relevant decisions. An OH&S specialist can support the method but cannot implement every action alone.
Consider changes before implementation, including temporary changes. A short-duration arrangement can still create significant risk. The detailed change-management process under clause 8.1.3 supports this planning connection.
Evidence and common mistakes
The relevant subclauses require documented information on risks and opportunities, planning processes and actions to the extent necessary for confidence in planned execution, and specific information such as risk-assessment methods and criteria and legal requirements. One integrated arrangement can hold the information if the distinct decisions remain clear.
Common weaknesses include treating a hazard list as a complete plan, ignoring existing-control effectiveness and assuming a numerical score overrides legal duties. Another is planning without workers who understand how the task actually unfolds. The useful output is a supported decision and implemented control, not a colour on a matrix.
Explore each numbered part
6.1.1 · establish proactive planning arrangements
The general planning requirement sets the basis for proactive decisions about OH&S risks and opportunities. Clause 6.1.1 draws on context, workers’ needs, scope, hazards and requirements, including planned changes. This guide explains how to organise the process and its documented information so that planning occurs before decisions become difficult to change.
6.1.2 · Identify Hazards and Assess Risk
Hazard identification, risk assessment and opportunity assessment answer different questions within OH&S planning. This guide connects the three source subclauses with BPO and construction examples, worker experience and defined assessment criteria. Learn to distinguish hazards from risk ratings and wider system risks, then use the findings to select relevant actions and controls.
6.1.3 · determine applicable legal and other requirements
A legal register is useful only when the organisation understands what applies to its work. Clause 6.1.3 requires access to current legal and other requirements, applicability decisions and integration into the OH&S system. This guide explains how to make those requirements usable across sites and contracts while distinguishing identification from evaluation of actual compliance.
6.1.4 · plan effective action on OH&S priorities
Action planning connects assessment with the way work is performed. Clause 6.1.4 covers risks and opportunities, legal and other requirements, and emergency situations, together with integration and evaluation. This guide explains how the hierarchy of controls, resources and practical ownership shape a response, and why completing a task does not establish that the action worked.
Frequently asked questions
Is one risk register enough?
It may support the process if it captures the required distinctions and decisions. A register alone does not demonstrate effective action.
Do opportunities need assessment too?
Yes. Consider opportunities to improve OH&S performance and the management system, including possible consequences of proposed changes.
Can a low risk score remove a legal duty?
No. Applicable legal and other requirements must be determined and addressed independently of a preferred scoring result.
Follow one planning decision into practice
Discuss OH&S planning with Sterling, including worker input, documentation and audit evidence. The Risk Management course develops useful assessment concepts; technical safety competence remains role-specific. Effivity ISO & GRC automation software can be scoped to agreed processes. See planning and the directory.